Other Articles
- EC2 Volume – Enable EBS Encryption
- EC2 Volume – Enable EBS Volume Backup
- EFS – Enable EFS Storage Backup
- EC2 Instance – Monitor CPU Utilization
- ECS Service – Monitor CPU Utilization
- ECS Service – Monitor Memory Utilization
- EC2 VPC – Ensure Flow Logs are Enabled
- S3 Bucket – Block S3 Bucket Public Access
- S3 Bucket – Enable S3 Bucket Versioning
- S3 Bucket – Enable S3 Bucket Encryption
- RDS DB Instance – Enable Auto Minor Version Upgrade
- RDS DB Instance – Block Public Access
- RDS DB Instance – Monitor Free Storage Space
- RDS DB Instance – Monitor CPU Utilization
- RDS DB Instance – Encryption of Storage
- RDS DB Instance – Enable Deletion Protection
- SQS Queue – Monitor Message Age
- SQS Queue – Monitor Message Visibility
- DynamoDB Table – Enable Table Encryption
- DynamoDB Table – Enable Table Point In Time Recovery
- DynamoDB Table – Enable Table Deletion Protection
- DynamoDB Table – Monitor Table Read Capacity
- DynamoDB Table – Monitor Table Write Capacity
- DynamoDB Table – Monitor Table Latency
- Enable User MFA
- Enforce Key Rotation
- Enforce Active Key Limit
- Disable Unused User Credentials
- Enforce Group Permission
- Enable CloudTrail
- Enable AWS Security Hub
- Enforce Password Length
- Prohibit Password Reuse
- Purge Expired Certificates
- Check Root Access Keys Existence
- Enable Root MFA
- Establish Support Role
- Enable Key Rotation
- Encrypt CloudTrail Logs
- Enable GuardDuty
EC2 Instance – Enable Deletion Protection
This check ensures that deletion protection is enabled for EC2 instances to prevent accidental or unauthorized termination and maintain service continuity.
Check Details
- Resource: EC2 Instance
- Check: Enable EC2 instance deletion protection
- Risk: Accidental termination of critical EC2 instances
Remediation via AWS Console
-
Log in to the AWS Management Console and open the
Amazon EC2 console.
- In the left navigation pane, click Instances and select the EC2 instance where deletion protection is not enabled.
-
Click Actions → Instance settings →
Change termination protection.
-
Choose Enable and click Save.
Remediation via AWS CLI
-
Log in to the AWS Management Console and click the
CloudShell icon (
>_) in the top-right corner.
-
Identify the EC2 instance ID:
aws ec2 describe-instances --query "Reservations[*].Instances[*].InstanceId" --output table -
Enable deletion (termination) protection:
aws ec2 modify-instance-attribute --instance-id <instance-id> --disable-api-termination -
Verify deletion protection is enabled:
aws ec2 describe-instance-attribute --instance-id <instance-id> --attribute disableApiTermination